In case of companies where the work is outsourced the Sarbanes Oxley compliance needs to be documented in differently. This is because the total work is done by an external agency. This is also especially important because any external agency would never give any document or certificate like SAS70 Type II or similar report. In such a case the company is required to document the whole process that has been outsourced as if the whole process has been done internally and state all the internal controls and regulation applied on that process which has been outsourced.
More on sarbanes oxley and sarbanes oxley training
Goal Setting Supreme